Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Bücher
Zeitschriften
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
MTZ-Fachkongress

Antriebe und Energiesysteme von morgen


Austausch von Automobil- und Energiewirtschaft

Am 14./15. Mai geht es in Chemnitz um die Mobilitätswende durch Elektro- und Wasserstofffahrzeuge.
Erweiterte Suche
Anmelden
nach oben
Erschienen in:
Overview of Electronic Commerce Kapitel lesen Erstes Kapitel lesen

2015 | OriginalPaper | Buchkapitel

10. E-Commerce Security and Fraud Issues and Protections

verfasst von : Efraim Turban, David King, Jae Kyu Lee, Ting-Peng Liang, Deborrah C. Turban

Erschienen in: Electronic Commerce

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

The State University of New York (SUNY) College at Old Westbury ( oldwestbury.edu ) is a relatively small U.S. university located in Long Island, New York. The college has 3,300 students and 122 full-time faculty. Internet access is essential for both faculty and students.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Jetzt informieren
Vorheriges Kapitel Marketing and Advertising in E-Commerce
Nächstes Kapitel Electronic Commerce Payment Systems
Anhänge
Nur mit Berechtigung zugänglich
Glossar
Access control 
A defense mechanism that determines who (person, program, or machine) can legitimately use the organization’s computing resources (which resources, when, and how).
Application controls 
Controls that guard applications.
Authentication 
A process to verify (assure) the real identity of an EC entity, which could be an individual, software agent, computer program, or EC website.
Authorization 
The provision of permission to an authenticated person to access systems and perform certain operations in those specific systems.
Availability 
The assurance that access to any relevant data, information websites, or other EC services and their use is available in real time, whenever and wherever needed.
Banking Trojan 
Malicious software programmed to create damage when users visit certain online banking or e-commerce sites.
Biometric authentication 
A technology that measures and analyzes the identity of people based on measurable biological or behavioral characteristics or physiological signals.
Biometric systems 
A system that can identify a previously registered person by searching through a database for a possible match based on the person’s observed physical, biological, or behavioral traits, or the system can verify a person’s identity by matching an individual’s measured biometric traits against a previously stored version.
Botnet 
Malicious software that criminals distribute, usually to infect a large number of computers.
Business continuity plan 
A plan that keeps the business running after a disaster occurs. Each function in the business should have a valid recovery capability plan.
Business impact analysis (BIA) 
An analysis of the impact of losing the functionality of an EC activity (e.g., e-procurement, e-ordering) to an organization.
Certificate authorities (CAs) 
Independent agencies that issue digital certificates or SSL certificates, which are electronic files that uniquely identify individuals and websites and enable encrypted communication.
CIA security triad (CIA triad) 
A point of reference used to identify problem areas and evaluate the information security of an organization that includes confidentiality, integrity, and availability.
Ciphertext 
An encrypted plaintext.
Controlling the assault of non-solicited pornography and marketing (CAN-SPAM) act 
Law that makes it a crime to send commercial e-mail messages with spam.
Cracker 
A malicious hacker who may be more damaging than a hacker.
Confidentiality 
The assurance of data secrecy and privacy. Namely, the data is disclosed only to authorized people.
Cybercrime 
Intentional crimes carried out on the Internet.
Cybercriminal 
A person who intentionally carries out crimes over the Internet.
Data breach 
A security incident in which data are obtained illegally and then published or processed.
Denial-of-service (DoS) attack 
“A malicious attempt to make a server or network resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet.” (Incapsula, Inc.)
Detection measures 
Methods that help find security breaches in computer systems. Usually this means to find out whether intruders are attempting (or have attempted) to break into the EC system, whether they were successful, whether they are still damaging the system, and what damage they may have done.
Deterrent methods 
Countermeasures that make criminals abandon their idea of attacking a specific system (e.g., a possible deterrent is a realistic expectation of being caught and punished).
Digital envelop 
The pair of encryptions that occurs the sender encrypts with the recipients’ public key, both the original message and the digital signature.
Digital signatures 
The electronic equivalent of personal signatures on paper. They are difficult to forge since they authenticate the identity of the sender that uses the public key.
EC security strategy 
Multiple layers of defense that includes several methods. This defense aims to deter, prevent, and detect unauthorized entry into an organization’s computer and information systems.
E-mail spam 
Occurs when almost identical messages are e-mailed to many recipients (sometimes millions of unsolicited e-mails).
Encryption 
The process of encoding data into a form (called a ciphertext) that will be difficult, expensive, or time-consuming for an unauthorized person to understand.
Encryption algorithm 
The set of procedures or mathematical algorithms used to encrypt or decrypt a message.
Exposure 
The estimated cost, loss, or damage that can result if a threat exploits a vulnerability.
Firewalls 
Barriers between an internal trusted network (or a PC) and the untrustworthy Internet. Technically, it is composed of hardware and a software package that separates a private computer network (e.g., your LAN) from a public network (the Internet).
Fraud 
Any business activity that uses deceitful practices or devices to deprive another of property or other rights.
General controls 
Controls designed to protect all system applications.
Hacker 
Someone who gains unauthorized access to a computer system.
Hash function 
A secured mathematical algorithm applied to a message.
Honeynet 
A network of honeypots designed to attract hackers, just as bees are attracted to honey.
Honeypot 
Simulated information system components such as EC servers, payments gates, routers, database servers, and even firewalls that look like real working systems.
Identity theft 
Wrongfully obtaining and using the identity of another person in some way to commit crimes that involve fraud or deception (e.g., for economic gain).
Information assurance (IA) 
The performance of activities (steps) to protect information systems and their processes against all risks. The assurance includes all tools and defense methods.
Information security 
Measures taken to protect information systems and their processes against all risks.
Integrity 
The assurance that data are accurate and that they cannot be altered.
Internet underground economy 
E-markets for stolen information made up of thousands of websites that sell credit card numbers, social security numbers, e-mail addresses, bank account numbers, social network IDs, passwords, and much more.
Intrusion detection system (IDS) 
A device composed of software and/or hardware designed to monitor the activities of computer networks and computer systems in order to detect and define unauthorized and malicious attempts to access, manipulate, and/or disable these networks and systems.
Key (key value) 
The secret piece used with the algorithm to encrypt (or decrypt) the message.
Key space 
The total universe of possible key values that can be created by a specific encryption algorithm.
Keystroke logging (keylogging) 
The process of using a device or software program that tracks and records the activity of a user in real time (without the user’s knowledge or consent) by the keyboard keys they press.
Macro virus (macro worm) 
A malware code that is attached to a data file rather than to an executable program (e.g., a Word file).
Malware (malicious software) 
A generic term for malicious software.
Message digest 
The results of the hash function that is a special summary of the message converted into a string of digits.
Nonrepudiation 
The assurance that online customers or trading partners cannot falsely deny (repudiate) their purchase, transaction, sale, or other obligation.
Packet 
Segment of the data and information exchanged between computers over the Internet.
Page hijacking 
Illegally copying website content so that a user is misdirected to a different website.
Penetration test (pen test) 
A method of assessing the vulnerability of a computer system, which is done by allowing experts to act as malicious attackers.
Personal firewall 
A firewall that protects desktop systems by monitoring all incoming traffic to your computer.
Pharming 
A scam where malicious code is installed on a computer and used to redirect victims to a bogus websites without their knowledge or consent.
Phishing 
A fraudulent process of attempting to acquire sensitive information by masquerading as a trustworthy entity.
Plaintext 
A human-readable text or message.
Prevention measures 
Ways to help stop unauthorized people from accessing the EC system (e.g., by using authentication devices and firewalls or by using intrusion prevention which is, according to TechTarget “a preemptive approach to network security used to identify potential threats and respond to them swiftly”).
Private key 
A key that only its owner knows.
Protocol tunneling 
Method used to ensure confidentiality and integrity of data transmitted over the Internet by encrypting data packets, and then encapsulating them in packets that can be transmitted across the Internet.
Public key 
A key that is known to all.
Public (asymmetric) key encryption 
An encryption method that uses two keys: public key and private key.
Public key infrastructure (PKI) 
A comprehensive framework for securing data flow and information exchange that overcomes some of the shortcomings of the one-key system.
Risk 
The probability that a vulnerability will be known and used.
Search engine spam 
The technology that enables the creation of spam sites.
Social engineering 
A type of nontechnical attack that uses some ruse to trick users into revealing information or performing an action that compromises a computer or network.
Spam 
The electronic equivalent of junk mail.
Spam site 
Pages that trick search engines into offering biased search results such so that the ranking of certain pages is inflated.
Splog 
Blogs created by spammers solely for advertising.
Spyware 
Tracking software that is installed by criminals or advertisers, without the user’s consent, in order to gather information about the user and direct it to advertisers or other third parties.
Standard of due care 
The minimum and customary practice that a company is reasonably expected to take to protect the company and its resources from possible risks.
Symmetric (private) key encryption 
A scheme in which the same key is used to encrypt and decrypt the plaintext.
Trojan horse 
A program that seems to be harmless or even looks useful but actually contains a hidden malicious code.
Virtual private network (VPN) 
A network that uses the Internet to transfer information in a secure manner.
Virus 
Programmed software inserted by criminals into a computer to damage the system; running the infected host program activates the virus.
Vulnerability 
Weakness in software or other mechanism that threatens the confidentiality, integrity, or availability of an asset (recall the CIA model). It can be directly used by a hacker to gain access to a system or network.
Vulnerability assessment 
A process of identifying and evaluating problem areas that are vulnerable to attack on a computerized system.
Worm 
A software code that can replicate itself automatically (as a “standalone” – without any human intervention). Worms use networks to propagate and infect a computer or handheld device and can even spread via instant messages.
Zombies 
Computers infected with malware that are under the control of a spammer, hacker, or other criminal.
Literatur
Acohido, B. “Black Hat Shows Hacker Exploits Getting More Sophisticated.” USA Today, August 3, 2011 (updated August 9, 2011).
Bailey, T., J. Kaplan, and A. Weinberg. “Playing War Games to Prepare for a Cyberattack.” McKinsey Quarterly, July 2012.
Bort, J. “For the First Time, Hackers Have Used a Refrigerator to Attack Businesses.” Business Insider, January 16, 2014.
Brooks, J. “Conficker: What It Is, How to Stop It and Why You May Already Be Protected.” eWeek, March 31, 2009.
CompTIA. “Trends in Information Security: A CompTIA Analysis of IT Security and the Workforce.” 2008.
Constantin, L. “Kill Timer Found in Shamoon Malware Suggests Possible Connection to Saudi Aramco Attack.” PC World, August 23, 2012.
Cooney, M., “10 Common Mobile Security Problems to Attack.” PC World, September 21, 2012
CyberSource. 13th Annual 2012 Online Fraud Report, CyberSource Corporation (2012).
CyberSource. 14th Annual 2013 Online Fraud Report, CyberSource Corporation (2013).
Davis, M. A. “Data Encryption: Piling On.” Information Week Reports, January 30, 2012a.
Davis, M. A. “2012 Strategic Security Survey.” Information Week, May 14, 2012b.
Dickey, C., M. Bahari, R. Bergman, and J. Barry.“The Covert War against Iran’s Nuclear Program.” Newsweek, December 13, 2010.
Falliere, N., and E. Chien. “Zeus: King of the Bots.” Security Response White paper, Symantec, November 2009.
Fisher, R. The Book on Networks: Everything You Need to Know about the Internet, Online Security and Cloud Computing. Seattle, WA: CreateSpace Independent Publishing Platform, 2014.
Fowler, G. A., and J. Valentino-DeVries. “Spate of Cyberattacks Points to Inside India.” The Wall Street Journal, June 23, 2013.
Habal, R. “How to Assess Cloud-Based E-Mail Security Vendors.” eWeek, September 28, 2010.
Harkins, J.M. Spyware. Charleston, NC: CreateSpace, 2011.
Jaishankar, K. (Ed.). Cyber Criminology: Exploring Internet Crimes and Criminal Behavior. Boca Raton, Florida: CRC Press, 2011.
Jones and Bartlett Learning LLC. “Fundamentals of Information Systems Security: Unit 1 – Information Systems Security Fundamentals.” 2012. ccahs.net/Fundamentals.U1.pdf (accessed May 2014).
Kaplan, J., C. Rezek, and K. Sprague. “Protecting Information in the Cloud.” McKinsey Quarterly, January 2013.
Kirk, J. “Security Company Scours ‘Dark Web’ for Stolen Data.” Computerworld, September 30, 2013.
Kontzer, T. “Cyber-Attacks Spur Innovative Security Approaches.” Baseline, May/June 2011.
Lawinski, J. “Companies Spend on Security Amid Mobile and Social Threats.” Baseline, September 14, 2011.
Lawinski, J. “Security Slideshow: Malicious Attacks Skyrocket as Hackers Explore New Targets.” CIO Insight, May 7, 2012.
Lerer, L. “Why the SEC Can’t Stop Spam.” Forbes, March 8, 2007.
MessageLabs. “How to Defend Against New Botnet Attacks.” A MessageLabs (Now Part of Symantec) White paper, 1011979. 2009.
Nuerm, J. Identity Theft Manual: Practical Tips, Legal Hints and Other Secret Revealed. Seattle, WA: Amazon Digital Services, Inc., 2012.
Palgon, G. “Simple Steps to Data Protection.” Security Management, June 2008. (No longer available online.)
Pattison, III, W. B. Attack of the Internet: Phishing Attempts, Pharming Scams, Swindles and Frauds. Seattle, WA: Amazon Digital Services, Inc., 2012.
Perez, E. “Hackers Siphoned $70 Million.” Wall Street Journal, Updated October 2, 2010.
Prince, B. “Kneber Botnet Highlights Trend of Social Networking Data Being Used by Hackers.” eWeek, February 18, 2010a.
Prince, B. “Massive Check Fraud Operation Run by Hackers Revealed at Black Hat.” eWeek, July 28, 2010b.
Reisinger, D. “10 Mobile Security Issues that Should Worry You.” eWeek, February 11, 2014.
Rhodes-Ousley, M. Information Security the Complete Reference, 2nd edition. New York: McGraw-Hill, 2013.
Russell, K. “Here’s How to Protect Yourself from the Massive Security Flaw That’s Taken over the Internet.” Business Insider, April 8, 2014.
Sarrel, M. “Stay Safe, Productive on Social Networks.” eWeek, March 28, 2010.
Scott, W. Information Security 249 Success Secrets- 249 Most Asked Questions on Information Security- What You Need to Know. Brisbane, Queensland, Australia: Emereo Publishing, 2014.
Snyder, J. “Staying One Step Ahead of Modern Hackers.” BizTech Magazine, March 14, 2014.
Suby, M. “The 2013 (ISC)2 Global Information Security Workforce Study.” Mountain View, CA: Frost and Sullivan, 2013.
Swann, C. T. Marlins Cry a Phishing Story. Spokane, WA: Cutting Edge Communications, Inc., 2012.
Talabis, M., and J. Martin. Information Security Risk Assessment Toolkit: Practical Assessment through Data Collection and Data Analysis. Maryland Heights, MO: Syngress, 2013.
Teller, T. “Social Engineering: Hacking the Human Mind.” Forbes, March 29, 2012.
Thomson, L. (Ed.) Data Breach and Encryption Handbook. Chicago, IL: American Bar Association, 2012.
Metadaten
Titel
E-Commerce Security and Fraud Issues and Protections
verfasst von
Efraim Turban
David King
Jae Kyu Lee
Ting-Peng Liang
Deborrah C. Turban
Copyright-Jahr
2015
Buch
Electronic Commerce

Print ISBN: 978-3-319-10090-6

Electronic ISBN: 978-3-319-10091-3

Copyright-Jahr: 2015

DOI
https://doi.org/10.1007/978-3-319-10091-3_10

Premium Partner

    Bildnachweise